Hackers Invade Hospital Networks

Connected_Health.jpg

The TrapX report, “Anatomy of an Attack–Medical Device Hijack (MEDJACK),” describes in detail three situations in which hackers were able to get into supposedly secure hospital networks, collecting valuable information, by targeting medical devices. 

Once into the devices, the hackers were able to roam at will through hospital networks. Their goal was the valuable health insurance information in patient records—this, TrapX stated, is worth 20 times the value of a credit card record on the black market. But had they wanted to, they could potentially have taken control of the devices themselves. Here are the three incidents detailed in the TrapX report.
    

  • A hospital where researchers discovered that three blood gas analyzers in the laboratory contained backdoors into the hospital network, and records were being sent to an unknown location in Europe;

    

  •     A hospital where hackers infected a Picture Archive and Communications System (PACS) in the hospital radiology department and then, using the PACS system, were able to move through that network collecting information and sending it Guiyang, China;

    

  •     A hospital where hackers installed a back door in X-ray equipment. 

    
From the compromised system, hackers were able to move through that network extracting information. How could this happen?

After all, the products we were creating were not being connected to a worldwide network of computers that anyone could access. In 1984, the Internet was barely in its infancy and not used by the general public (the first commercial dial-up Internet Service Provider was formed in 1990); the World Wide Web (1991) had yet to be invented. Our systems were secure, because they would operate in isolation. It was an appropriate design choice at the time.

So the world has changed, but many medical devices and systems have not. The basic software architecture of many of the devices used in hospitals and medical clinics today is still based on designs from 10 or 20 years ago.  The software may have been updated to support graphical or touchscreen user interfaces, enable greater connectivity to IT networks and increase ease-of-use, but security has rarely been a priority when building new versions of these old designs.   
Over the past 25 years the automotive industry has made tremendous progress in vehicle safety. When I was child, seatbelts were the primary safety feature in most cars.  Today cars are designed to withstand collisions at even high speeds. Anti-lock brakes, airbags and a host of other safety features are standard and automakers continue to invest heavily in improving safety. 

These advances are the result of automakers embracing safety as a fundamental design principal and making heavy investments into safety.  It is time for medical device companies to follow suit and treat security as a fundamental design component, not an optional add-on. It is no longer sufficient to refresh old versions of products with a few new features. New platforms and architectures must be adopted that incorporate security into the every level of product design from selection of hardware platforms through application implementation.

As the MedJack report shows, any insecure medical device, whether it is preforming a critical function or not, can be targeted by hackers. Once compromised, they can then be used as a beachhead to penetrate more deeply into medical networks. Security must be considered a critical component of all devices, even those performing seemingly insignificant tasks. And that includes implanted medical devices, as the University of Michigan’s Kevin Fu points out here, just because they are inside your body, they are not invulnerable.

Building security into new devices is critical to ensure the next generation of medical devices does not suffer from the security problems outlined in the MedJack report. But a larger problem still exists. There are millions of legacy devices with weak or non-existent security in use today. The cost to replace these devices would run into the hundreds of billions of dollars. Realistically, it will take a decade or more to replace all of these devices. 
A cost-effective alternative is needed for these systems. One option is a low cost bump-in-the-wire (BITW) security device. Such a device can be installed in front of a legacy device and used to control all network communication with the device. I describe that approach in more detail in “How to Build a Safer Internet of Things” published in IEEE Spectrum earlier this year.

The report proves that medical devices are being targeted by cybercriminals. Stopping these attacks will require a change of mindset by everyone involved in using and developing medical devices. Much like the auto industries approach to safety, this will require a long-term commitment and a “security first” mindset. 
IEEE:  http://bit.ly/1QFrk3k

« Cybersecurity in the Boardroom
Samsung Will Fix Security Hole in Galaxy Smartphones »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Free Access: Cyber Security Supplier Directory listing 5,000+ specialist service providers.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Fuel Recruitment

Fuel Recruitment

Fuel Recruitment is a specialist recruitment company for the IT, Telecoms, Engineering, Consulting and Marketing industries.

Gamma

Gamma

Gamma provide a comprehensive range of next generation voice, data and mobile services including Managed Network Security and secure Mobile solutions.

Paladion

Paladion

Paladion is a provider of managed IT security services.

Cyentia Institute

Cyentia Institute

The Cyentia Institute is a research & data science firm with a mission to advance knowledge in the cybersecurity industry.

Red River

Red River

Red River is a technology transformation company, bringing 25 years of experience and mission-critical expertise in analytics, cloud, collaboration, mobility, networking and security solutions.

HENSOLDT Cyber

HENSOLDT Cyber

HENSOLDT Cyber introduces a paradigm shift to cyber security. Our products have been designed to ensure the integrity of embedded systems at the core: the operating system and the processor.

Tactic Labs

Tactic Labs

Tactic Labs (part of the Avnon Group) delivers a holistic Cyber-Security Management Platform which provides military-grade protection, safeguarding critical infrastructures and mission-critical data.

DoQubiz Technology

DoQubiz Technology

DoQubiz is using the idea of security through obscurity to develop their proprietary Fractal Security Engine that implements a highly resilient data protection protocol.